Conciseness

The body is dense and operational — an 18-row precedence table, copy-paste curl probes, and no filler explaining concepts Claude already knows. It is not a 5 because the core exploit pattern is restated three times ("The exploitable pattern: WAF/proxy reads value A, app reads value B" in §1, "The WAF inspects one occurrence; the app concatenates / picks the other" in §3, "The auth layer evaluates one value; the controller acts on another" in §4) and the §5 intro repeats §1's framing — minor trimming opportunities; it is well above a 3 since nearly all content earns its place.

Actionability

Fully executable throughout: curl commands with --data-urlencode duplicates, a stack-fingerprinting reflection loop, a client-side HPP probe piped to grep, and named tools with exact flags (sqlmap --param-del=';' -p 'q' --skip-urlencode, wfuzz -z list). The per-stack table gives the exact values each parser returns, covering the common cases copy-paste ready. Nothing is pseudocode or hand-wavy.

Workflow Clarity

The sections follow a coherent implicit sequence — fingerprint the stack via reflection (§2), attempt WAF bypass (§3), server-side auth/ACL bypass (§4), client-side HPP (§5), injection delivery (§6) — and §9's decision gate provides explicit observation-to-action checkpoints. Not a 5 because the sequence is implicit (sections are topical, not numbered steps) and validation feedback beyond the decision gate is limited to the differential baseline comparison; comfortably above a 3 since the decision gate supplies real checkpoints and the baseline/differential method is explicit.

Progressive Disclosure

A self-contained single-file skill with no bundle directories (references/, scripts/, assets/ absent), so everything must live inline — and it is well organized into nine clearly headed sections with the lookup table as the core asset. Not a 5 because the 18-row parser precedence table is exactly the kind of bulky reference data that could move to a references/ file, and the cross-references at the end point to sibling skill paths that are not part of this bundle; well above a 3 since structure and navigation are clean.

Specificity

The description names the domain ("HTTP Parameter Pollution") and lists several concrete capability areas — "parser discrepancies between proxy/server/app", "WAF bypass", "auth/ACL bypass", "injection delivery" — which map to distinct, actionable outcomes. It falls short of a 5 because these are terse noun phrases rather than enumerated actions, and coverage of the skill's actual operations (detection, fingerprinting, tooling) is implied rather than stated; it is clearly above a 3, which requires only 1-2 concrete actions.

Completeness

The "what" is clear (parser discrepancy exploitation across proxy/WAF/app layers for bypass and injection delivery), but the description field contains no "Use when..." clause or equivalent explicit trigger guidance — those triggers live in the separate metadata when_to_use field. Per the rubric guideline, a missing explicit "when" in the description caps completeness at 3; it is not a 2 because the "what" is concrete and specific, and not a 4 because no "when" is present even weakly in the description itself.

Trigger Term Quality

"HTTP Parameter Pollution", "WAF bypass", "parser discrepancies", and "injection delivery" are terms a user would naturally say when needing this skill. Not a 5 because the description field itself omits common variations users would type — the "HPP" acronym and "duplicate parameters" appear only in the metadata when_to_use field, not in the description; it is above a 3 since several natural, relevant keywords are present.

Distinctiveness Conflict Risk

HTTP Parameter Pollution is a clearly distinct technique niche with its own trigger vocabulary (duplicate parameters, parser precedence). Minor overlap risk exists with closely related sibling skills the body itself cross-references (waf-bypass, sqli), whose scopes ("WAF bypass", "injection delivery") partially appear in this description; it is not a 5 for that residual overlap, and well above a 3 because the core trigger (parameter pollution/precedence) is unambiguous.